BIND DNS Servers Hit by 14 Security Flaws Enabling Cache Poisoning and Remote Crashes
ISC patched 14 high-severity BIND 9 flaws enabling DNS cache poisoning, DNSSEC bypass, and remote crashes of exposed recursive resolvers.
Internet Systems Consortium released BIND 9 updates fixing 14 vulnerabilities, all rated High, including cache-poisoning flaws CVE-2025-40778 and CVE-2025-40780 and multiple remote denial-of-service issues affecting the widely used named daemon. Several flaws can be triggered by malicious DNS responses or crafted client queries against internet-facing recursive resolvers, DoH endpoints, and DNSSEC-validating servers. ISC changed DNAME/NS record acceptance, replaced the weak PRNG with a cryptographically secure generator, and added resource-exhaustion limits; administrators should upgrade and restrict recursion to trusted clients.
- CVE-2025-40778: spoofing weaknesses allow forged records in resolver caches without DNSSEC
- CVE-2025-40780: predictable UDP ports and transaction IDs from weak PRNG
- Remote DoS flaws include SIG(0) crashes (CVE-2026-5947) and DoH use-after-free (CVE-2026-3593)
- ISC added limits for DNSSEC validation work, large nameserver lists, and cache growth
- CVEs
- CVE-2025-40775CVE-2025-40777CVE-2025-40778CVE-2025-40780CVE-2025-8677CVE-2026-1519CVE-2026-3104CVE-2026-3119CVE-2026-3591CVE-2026-3592CVE-2026-3593CVE-2026-5946CVE-2026-5947CVE-2026-5950
- Vendors
- Internet Systems Consortium
- Products
- BIND
- Organizations
- Internet Systems Consortium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-40775 | When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it | 7.5 | 15% | ||
| CVE-2025-40777 | If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other… | 7.5 | <1% | ||
| CVE-2025-40778 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache | 8.6 | <1% | ||
| CVE-2025-40780 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source… | 8.6 | <1% | ||
| CVE-2025-8677 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion | 7.5 | 11% | ||
CVE-2026-1519+3 related CVEs | If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU | 7.5 group max | 2% | ||
CVE-2026-3593+4 related CVEs | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation | 9.8 group max | 2% |
From the original article
2 min read at cybersecuritynews.com
Internet Systems Consortium has released security updates for BIND 9 after identifying 14 vulnerabilities that could allow attackers to poison DNS caches, crash exposed servers remotely, exhaust resources, or bypass DNSSEC protections. Administrators running recursive BIND resolvers should apply the latest patched releases as soon as possible. The most serious issues affect the named daemon, […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.